Nmap Full TCP Port Sweep + Service Scan
Two-stage recon: fast all-ports scan, then version/script scan only the ports that came back open.
# 1) fast sweep of all 65535 TCP ports
nmap -p- --min-rate 5000 -T4 -oN nmap-allports.txt <target-ip>
# 2) pull the open ports from the sweep, then deep-scan just those
ports=$(grep -oP '^\d+(?=/tcp\s+open)' nmap-allports.txt | paste -sd, -)
nmap -sC -sV -p "$ports" -oN nmap-services.txt <target-ip>